HIKVISION DS-7316HI-S

Table of Contents

1 Symptoms

The HIKVISION DS-7316HI-S is an NVR supporting analog CCTV cameras which I got for free. It was declared to be broken and indeed was failing to boot. The console output was providing the following hints: 

U-Boot 1.2.0 (Nov 28 2009 - 10:58:12)

DRAM:  256 MB
AMD Flash devid:0x227e id3:0x2221 id4:0x2201 ARM Clock : 364MHz
DDR Clock : 310MHz
Hit ctrl+u to stop autoboot:  0 ### JFFS2 loading 'uImage' to 0x80700000
jffs2: scanning filesystem . done.
jffs2: cannot find inode(uImage)
### JFFS2 load uImage error(0)
## Booting image at 80700000 ...
Bad Magic Number
HKVS #

1.1 RS-232 interface fix

The bootloader is U-Boot but the console did not work. It would print the above messages but did not accept any input. After investigating this I found out that the RS-232 interface receive path seemed to be broken so I replaced the SP2020EEN chip that was responsible. After this the boot process could be stopped and the U-Boot console accessed. Some discovery follows: 

U-Boot 1.2.0 (Nov 28 2009 - 10:58:12)

DRAM:  256 MB
AMD Flash devid:0x227e id3:0x2221 id4:0x2201 ARM Clock : 364MHz
DDR Clock : 310MHz
Hit ctrl+u to stop autoboot:  0 HKVS # help                                              ?       - alias for 'help'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
format  - format nand except bootloader area
fsinfo	- print information about filesystems
fsload	- load binary file from a filesystem image
go      - start application at address 'addr'
help    - print online help
ls	- list files in a directory (default /)
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
ping	- send ICMP ECHO_REQUEST to network host
pready  - set panel to ready
printenv- print environment variables
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
update  - update digicap.dav
updateb - update uboot(u-boot.bin) to nor
updatebl- update ubl(ubl_646x.bin) to nand
updatefs- update filesystem(davinci.img) to nand
updatek - update kernel(uImage) to nand
updates - serial update kernel or filesys
HKVS # printenv
bootargs=console=ttyS0,115200n8 initrd=2g,1 root=/dev/ram
bootdelay=3
baudrate=115200
ipaddr=192.0.0.64
serverip=192.0.0.128
bootfile="uImage"
netmask=255.255.255.0
bootcmd=fsload 0x80700000 uImage;bootm
ethaddr=00:40:48:38:15:07

Environment size: 230/131068 bytes
HKVS # fsinfo
### filesystem type is JFFS2
jffs2: scanning filesystem . done.
Compression: NONE
	frag count: 1569
	compressed sum: 6204344
	uncompressed sum: 6204344
Compression: ZERO
	frag count: 0
	compressed sum: 0
	uncompressed sum: 0
Compression: RTIME
	frag count: 0
	compressed sum: 0
	uncompressed sum: 0
Compression: RUBINMIPS
	frag count: 0
	compressed sum: 0
	uncompressed sum: 0
Compression: COPY
	frag count: 0
	compressed sum: 0
	uncompressed sum: 0
Compression: DYNRUBIN
	frag count: 0
	compressed sum: 0
	uncompressed sum: 0
Compression: ZLIB
	frag count: 352
	compressed sum: 591484
	uncompressed sum: 1422185
HKVS # ls -rwxrwxrwx   711436 Thu Jan 01 00:00:00 1970 rootfs.img -rwxrwxrwx   829440 Thu Jan 01 00:00:00 1970 720.422 -rwxrwxrwx   269846 Thu Jan 01 00:00:00 1970 ds8062_fpga.rbf -rwxrwxrwx      267 Thu Jan 01 00:00:00 1970 initrun.sh -rwxrwxrwx  4297989 Thu Jan 01 00:00:00 1970 guirc.tar.gz -rwxrwxrwx  1510288 Thu Jan 01 00:00:00 1970 webs.tar.gz
HKVS #

We can see what is wrong here, the 'bootcmd' contains instructions to load the uImage from jffs2 but there is no file named uImage there so the boot process fails.

1.2 Firmware restore

I found a firmware image and a user's manual on a Polish CCTV shop download site (old-skool plain file server!). In order to perform the update you need to setup...

Read more »